PT-2021-20261 · Sap · Internet Communication Manager+1

Published 2021-07-14 · Updated 2023-09-28 · CVE-2021-33683

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SAP Web Dispatcher and Internet Communication Manager (ICM) versions 7.21 through 7.83

Description: The issue arises from the incorrect handling of invalid HTTP headers, specifically the Transfer-Encoding header, which can lead to an HTTP Request Smuggling attack. This could allow an attacker to bypass web application firewall protection and divert sensitive data, including customer requests and session credentials.

Recommendations: For SAP Web Dispatcher and Internet Communication Manager (ICM) versions 7.21 through 7.83, update to a version that correctly handles invalid HTTP headers to prevent HTTP Request Smuggling attacks. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to protect against potential attacks.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-33683

Affected Products

Internet Communication Manager

Sap Web Dispatcher

References · 6

• https://osv.dev/vulnerability/CVE-2021-33683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33683 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3000663 · Note
• https://t.me/cibsecurity/26141 · Telegram Post
• https://t.me/cvenotify/17590 · Telegram Post